How to Verify a Certificate of Destruction.
Ten checks that separate a real certificate from a piece of paper, in the order an auditor would run them.
To verify a certificate of destruction, check that it names your company, lists devices by serial number, states a method that suits each type of media, carries dates that match the pickup, comes from an identifiable issuer, and is backed by per-drive erasure reports where drives were wiped. Then sample ten serials against your asset register. A certificate that lists only quantities proves very little.
Ten checks, in order.
- It names you. Your company, and ideally the site the devices came from.
- It lists devices, not just a count. Serial numbers or asset tags for each device or drive. “150 laptops destroyed” proves very little.
- The serials match your register. Pick ten at random and find them in your asset register. Any that do not match need an explanation.
- It states the method. Wiped, degaussed or shredded, per device, and the standard used for wiping.
- The method fits the media. Degaussing on an SSD is a red flag: it does not work on flash.
- It has dates that make sense. Destruction after pickup, before resale or recycling, and consistent with the manifest date.
- The issuer is identifiable. A legal entity name, address and signatory, and for recycling, an authorisation you can check.
- Erasure reports are attached. For wiped drives, the software reports should exist per drive and carry a digital signature or protection.
- It links to the manifest. The pickup manifest and the certificate should describe the same job.
- You can get it again. The issuer keeps a copy and can reissue or confirm it if an auditor asks.
Where this guide fits.
This closes our certificate series. If you are new to the topic, start with what a certificate of destruction is and what it looks like. Then read what a data erasure certificate must show and how it differs from a recycling certificate. For the audit itself, see how to prove data destruction to an auditor.
Questions, answered.
Ask the vendor for the device-level list behind it. If none exists, treat the job as undocumented and record the gap in your risk register.
A document can be forged, which is why the checks above matter: serials that match your register, erasure reports with digital signatures, and an issuer you can contact.
At least as long as the asset records they relate to, and as long as your audit, contract or regulatory obligations require. Your auditor or legal team sets the exact period.
Ask the vendor to correct or explain it in writing. If they cannot, escalate internally, note it in your risk register, and review whether the devices may still hold data outside your control.
Last reviewed 30 September 2026. Sources: NIST SP 800-88 Rev. 2.
Want certificates that pass every check?
Every PrivAce job comes with a Certificate of Destruction, per-drive erasure reports for wiped media and the pickup manifest.
